@capybara-hq/plugin-tools 0.1.0-rc.4 → 0.1.0-rc.5

package/README.md

@@ -41,21 +41,28 @@ capybara-plugin release [--dry-run] [--provenance] [--out <dir>] [--auto] [--roo
   plugin itself and files inside the plugin, by import, package-name string or path) and the
   release metadata (`plugin-release-metadata`: a public plugin has a `description`, a `license`, an
   https `homepage` and `repository` `{ type: "git", url: <the root package.json's
-  repository.url>, directory: <its dir> }`; `example-*` plugins are private). `--base <ref>` also fails when the diff edits, deletes or renames an applied
+  repository.url>, directory: <its dir> }`; `example-*` plugins are private; its `plugin.json`
+  has a `displayName`, and `release-description-zh` warns, without failing, when its `description`
+  has no `zh`). Warnings are printed under `passed with N warning(s)`. `--base <ref>` also fails when the diff edits, deletes or renames an applied
   migration, or adds one numbered at or below the highest number of its directory at `<ref>`. No plugin found is an error. A plugin may list `@capybara-hq/plugin-tools` (like
   `@capybara-hq/testing`) in its devDependencies.
 - **sync-versions**: after `changeset version` (which bumps only `package.json`), copies each
   plugin's version into its `.capybara-plugin/plugin.json` and its extension manifest
   (`src/index.ts`, `  version: "x"`), which the packer requires equal.
-- **marketplace**: `--write` appends to `.capybara-plugin/marketplace.json` (`--file`) one npm entry
-  per public plugin version it does not list yet (`name`, `version`, `summary`, `homepage`,
+- **marketplace**: `--write` keeps one npm entry per public plugin in
+  `.capybara-plugin/marketplace.json` (`--file`), its current version (`name`, `version`,
+  `summary` from the `plugin.json` `description`, `displayName` from `plugin.json`, `homepage`,
   `permissions`, `source.npm` with the sha512 of a reproducible pack), formatted as Biome formats
-  it; `--check` fails when an entry is missing (`marketplace-missing`) or the file does not parse
-  (`marketplace-invalid`). A version already listed is not compared with the tree: once
+  it: a plugin whose version moved gets its entry replaced in place, its other versions are
+  dropped, a listed entry's `summary` / `displayName` are refreshed from `plugin.json`
+  (`marketplace-display-stale` in `--check`; source and integrity untouched), and entries of
+  plugins not in the tree are kept. `--check` fails when a plugin's
+  current version is missing or not its only entry (`marketplace-missing`) or the file does not
+  parse (`marketplace-invalid`). A version already listed is not compared with the tree: once
   published, its bytes are the release gate's business. `--check --base <rev>` (pull requests)
-  also requires the entries at `<rev>` to stay unchanged and first, in order
-  (`marketplace-append-only`), and the entries added since to match their packs
-  (`marketplace-integrity`). Entries of versions no longer in the tree are kept.
+  also requires a plugin's version to only increase over the versions `<rev>` lists
+  (`marketplace-version-decrease`), a version `<rev>` lists to keep its integrity, and the entries
+  added since to match their packs (`marketplace-integrity`).
 - **release**: publishes every non-private workspace package whose version is not on npm yet:
   plugins (the packages under `plugins/`) as their plugin tgz, libraries through `pnpm pack`, with
   the dist-tag rule (prerelease `next`, backport `release-<major>.<minor>`, else `latest`), then

package/dist/check/index.d.ts

@@ -3,6 +3,7 @@ export { CHECK_USAGE, checkCommand } from "./cli.js";
 export { checkConfigForms } from "./config-forms.js";
 export { checkDeps } from "./deps.js";
 export { checkMigrations, checkSql } from "./migrations.js";
+export { checkOrgOverride } from "./org-override.js";
 export { checkPluginPack, PLUGIN_PACK_MAX_BYTES } from "./plugin-pack.js";
 export { checkPluginPermissions } from "./plugin-permissions.js";
 export { checkPluginState } from "./plugin-state.js";

package/dist/check/index.js

@@ -3,6 +3,7 @@ export { CHECK_USAGE, checkCommand } from "./cli.js";
 export { checkConfigForms } from "./config-forms.js";
 export { checkDeps } from "./deps.js";
 export { checkMigrations, checkSql } from "./migrations.js";
+export { checkOrgOverride } from "./org-override.js";
 export { checkPluginPack, PLUGIN_PACK_MAX_BYTES } from "./plugin-pack.js";
 export { checkPluginPermissions } from "./plugin-permissions.js";
 export { checkPluginState } from "./plugin-state.js";

package/dist/check/org-override.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from "./source.js";
+/**
+ * `plugin-org-override-unbound` (a warning): an extension whose deployment config has an
+ * `orgAccess(…, "override")` field, but that registers no tool, no `ctx.ui` view or action, no
+ * hook and provides none of `web-search`, `web-fetch`, `directory`, `model-provider` or
+ * `file-preview`. An override reaches the extension only in the per-call `config` of those entry
+ * points, so the field can never take effect. Findings point at the plugin's `src/index.ts`.
+ * A plugin that does not bundle or import is left to "Plugin pack".
+ */
+export declare function checkOrgOverride(pluginDirs: string[]): Promise<Finding[]>;

package/dist/check/org-override.js

@@ -0,0 +1,62 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { extensionConfigSchemas } from "../pack/config-schemas.js";
+import { importPluginExtension } from "../pack/pack.js";
+import { findCtxCalls } from "./plugin-permissions.js";
+/** Extension points whose calls carry the org's per-call config on their own. */
+const ORG_AWARE_POINTS = new Set([
+    "web-search",
+    "web-fetch",
+    "directory",
+    "model-provider",
+    "file-preview",
+]);
+/** The top-level properties of a deployment schema marked `x-org: "override"`. */
+function overrideFields(schema) {
+    const props = schema?.properties;
+    if (typeof props !== "object" || props === null)
+        return [];
+    return Object.entries(props)
+        .filter(([, v]) => v?.["x-org"] === "override")
+        .map(([k]) => k);
+}
+/**
+ * `plugin-org-override-unbound` (a warning): an extension whose deployment config has an
+ * `orgAccess(…, "override")` field, but that registers no tool, no `ctx.ui` view or action, no
+ * hook and provides none of `web-search`, `web-fetch`, `directory`, `model-provider` or
+ * `file-preview`. An override reaches the extension only in the per-call `config` of those entry
+ * points, so the field can never take effect. Findings point at the plugin's `src/index.ts`.
+ * A plugin that does not bundle or import is left to "Plugin pack".
+ */
+export async function checkOrgOverride(pluginDirs) {
+    const findings = [];
+    for (const dir of pluginDirs) {
+        const file = join(dir, "src/index.ts");
+        if (!existsSync(file))
+            continue;
+        let ext;
+        try {
+            ext = await importPluginExtension(dir);
+        }
+        catch {
+            continue;
+        }
+        const fields = overrideFields(extensionConfigSchemas(ext.config).schemas.deployment);
+        if (fields.length === 0)
+            continue;
+        const calls = findCtxCalls(dir);
+        if (calls.tools || calls.ui || calls.hooks)
+            continue;
+        const provided = (ext.provides ?? []).map((p) => String(p).split("@")[0] ?? "");
+        if (provided.some((p) => ORG_AWARE_POINTS.has(p)))
+            continue;
+        findings.push({
+            file,
+            line: 1,
+            rule: "plugin-org-override-unbound",
+            severity: "warning",
+            message: `deployment config field ${fields.join(", ")} allows an org override, but the extension registers no tool, ui view, action or hook and provides no org-aware extension point (${[...ORG_AWARE_POINTS].join(", ")}), so no per-call config ever reaches it`,
+        });
+    }
+    return findings;
+}

package/dist/check/plugin-permissions.d.ts

@@ -37,3 +37,17 @@ export declare function checkPluginPermissions(pluginDirs: string[]): Finding[];
  * Unparseable files are skipped here; the permissions check reports them.
  */
 export declare function findToolRegistrations(pluginDirs: string[]): ToolRegistration[];
+/** The `ctx.<area>.<method>` calls an extension's setup makes (see {@link findCtxCalls}). */
+export interface CtxCalls {
+    /** `ctx.tools.register` is called. */
+    tools: boolean;
+    /** `ctx.ui.view` or `ctx.ui.action` is called. */
+    ui: boolean;
+    /** `ctx.hooks.on` is called. */
+    hooks: boolean;
+}
+/**
+ * Which of `ctx.tools.register`, `ctx.ui.view|action` and `ctx.hooks.on` the non-test sources
+ * under `pluginDir` call, found by the same scanner as {@link checkPluginPermissions}.
+ */
+export declare function findCtxCalls(pluginDir: string): CtxCalls;

package/dist/check/plugin-permissions.js

@@ -166,7 +166,7 @@ function readManifest(obj, decls) {
     }
     return m;
 }
-function scanSetup(f, m, decls, onTool) {
+function scanSetup(f, m, decls, onTool, onCall) {
     const out = [];
     /** 明确的违规：豁免注释不起作用。 */
     const add = (at, rule, message) => {
@@ -240,6 +240,8 @@ function scanSetup(f, m, decls, onTool) {
                 if (obj.type !== "MemberExpression" || !isCtx(obj.object))
                     return;
                 const area = memberName(obj);
+                if (area !== undefined)
+                    onCall?.(area, method);
                 if (area === "http" && method === "route") {
                     const verb = args[0] ? stringValue(resolve(args[0], decls)) : undefined;
                     const path = args[1] ? stringValue(resolve(args[1], decls)) : undefined;
@@ -346,7 +348,7 @@ function scanSetup(f, m, decls, onTool) {
     }
     return out;
 }
-function scanFile(f, onTool) {
+function scanFile(f, onTool, onCall) {
     const decls = buildDecls(f);
     const out = [];
     walk(f.program, (n) => {
@@ -359,7 +361,7 @@ function scanFile(f, onTool) {
         const obj = arg ? resolve(arg, decls) : undefined;
         if (obj?.type !== "ObjectExpression")
             return;
-        out.push(...scanSetup(f, readManifest(obj, decls), decls, onTool));
+        out.push(...scanSetup(f, readManifest(obj, decls), decls, onTool, onCall));
     });
     return out;
 }
@@ -417,3 +419,26 @@ export function findToolRegistrations(pluginDirs) {
     }
     return out.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
 }
+/**
+ * Which of `ctx.tools.register`, `ctx.ui.view|action` and `ctx.hooks.on` the non-test sources
+ * under `pluginDir` call, found by the same scanner as {@link checkPluginPermissions}.
+ */
+export function findCtxCalls(pluginDir) {
+    const out = { tools: false, ui: false, hooks: false };
+    for (const { file, isTest } of listSourceFiles(pluginDir)) {
+        if (isTest)
+            continue;
+        const parsed = parseFile(file);
+        if (isParseError(parsed))
+            continue;
+        scanFile(parsed, undefined, (area, method) => {
+            if (area === "tools" && method === "register")
+                out.tools = true;
+            else if (area === "ui" && (method === "view" || method === "action"))
+                out.ui = true;
+            else if (area === "hooks" && method === "on")
+                out.hooks = true;
+        });
+    }
+    return out;
+}

package/dist/check/release-metadata.d.ts

@@ -11,5 +11,8 @@ import type { Finding } from "./source.js";
  * `check:release-metadata`.
  * `release-display-name`: a published plugin's `.capybara-plugin/plugin.json` needs a
  * `displayName` (`{ zh, en }`), the name every page shows instead of the package name.
+ * `release-description-zh` (a warning, never an error, so third-party marketplaces are not
+ * blocked): a published plugin's `description` has no `zh` (`marketplace --write` copies it into
+ * the marketplace `summary`, which the Chinese UI shows).
  */
 export declare function checkPluginReleaseMetadata(plugins: string[], root: string): Finding[];

package/dist/check/release-metadata.js

@@ -3,23 +3,27 @@ import { basename, join, relative } from "node:path";
 import { PLUGIN_MANIFEST_FILE } from "@capybara-hq/plugin-sdk";
 const RULE = "plugin-release-metadata";
 const DISPLAY_NAME_RULE = "release-display-name";
+const DESCRIPTION_ZH_RULE = "release-description-zh";
 /**
- * Does the plugin's `.capybara-plugin/plugin.json` lack `displayName`? False when the file is
- * missing or not JSON: "Plugin pack" reports those.
+ * The plugin's `.capybara-plugin/plugin.json` as an object; undefined when the file is missing or
+ * not a JSON object ("Plugin pack" reports those).
  */
-function lacksDisplayName(file) {
+function readManifest(file) {
     if (!existsSync(file))
-        return false;
+        return undefined;
     try {
         const m = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, ""));
-        return (typeof m === "object" &&
-            m !== null &&
-            m.displayName === undefined);
+        return typeof m === "object" && m !== null && !Array.isArray(m)
+            ? m
+            : undefined;
     }
     catch {
-        return false;
+        return undefined;
     }
 }
+/** A description without a `zh` text: a string, or an object without `zh`. */
+const lacksZh = (d) => typeof d === "string" ||
+    (typeof d === "object" && d !== null && d.zh === undefined);
 const readJson = (file) => JSON.parse(readFileSync(file, "utf8"));
 /** `repository.url` of a package.json (`"repository": "<url>"` or `{ url }`). */
 function repositoryUrl(pkg) {
@@ -43,6 +47,9 @@ function repositoryUrl(pkg) {
  * `check:release-metadata`.
  * `release-display-name`: a published plugin's `.capybara-plugin/plugin.json` needs a
  * `displayName` (`{ zh, en }`), the name every page shows instead of the package name.
+ * `release-description-zh` (a warning, never an error, so third-party marketplaces are not
+ * blocked): a published plugin's `description` has no `zh` (`marketplace --write` copies it into
+ * the marketplace `summary`, which the Chinese UI shows).
  */
 export function checkPluginReleaseMetadata(plugins, root) {
     const out = [];
@@ -69,7 +76,8 @@ export function checkPluginReleaseMetadata(plugins, root) {
         if (typeof pkg.license !== "string")
             finding(`${label} is published and needs a "license"`);
         const manifestFile = join(dir, PLUGIN_MANIFEST_FILE);
-        if (lacksDisplayName(manifestFile)) {
+        const manifest = readManifest(manifestFile);
+        if (manifest !== undefined && manifest.displayName === undefined) {
             out.push({
                 file: manifestFile,
                 line: 1,
@@ -77,6 +85,15 @@ export function checkPluginReleaseMetadata(plugins, root) {
                 message: `${label} is published and needs a "displayName" in ${PLUGIN_MANIFEST_FILE}: { "zh": …, "en": … }, the name pages show`,
             });
         }
+        if (manifest !== undefined && lacksZh(manifest.description)) {
+            out.push({
+                file: manifestFile,
+                line: 1,
+                rule: DESCRIPTION_ZH_RULE,
+                severity: "warning",
+                message: `${label} is published and its description has no zh: write "description": { "en": …, "zh": … } in ${PLUGIN_MANIFEST_FILE} (the marketplace summary the Chinese UI shows)`,
+            });
+        }
         if (typeof pkg.homepage !== "string" || !pkg.homepage.startsWith("https://")) {
             finding(`${label} is published and needs an https "homepage"`);
         }

package/dist/check/report.d.ts

@@ -1,8 +1,9 @@
-import type { Finding } from "./source.js";
+import { type Finding } from "./source.js";
 /** One finding as a line: `<file relative to root>:<line> <rule> <message>`. */
 export declare const formatFinding: (f: Finding, root: string) => string;
 /**
- * Prints the result of one check: `[name] passed`, or the finding count and one line per finding
- * (stderr). Returns whether it passed.
+ * Prints the result of one check: `[name] passed` (`passed with N warning(s)` and one line per
+ * warning when it has only warnings), or the finding count and one line per finding (stderr).
+ * Returns whether it passed (warnings do not fail it).
  */
 export declare function printCheck(name: string, findings: Finding[], root: string): boolean;

package/dist/check/report.js

@@ -1,16 +1,26 @@
 import { relative } from "node:path";
+import { errorsOf } from "./source.js";
 /** One finding as a line: `<file relative to root>:<line> <rule> <message>`. */
 export const formatFinding = (f, root) => `${relative(root, f.file) || f.file}:${f.line} ${f.rule} ${f.message}`;
 /**
- * Prints the result of one check: `[name] passed`, or the finding count and one line per finding
- * (stderr). Returns whether it passed.
+ * Prints the result of one check: `[name] passed` (`passed with N warning(s)` and one line per
+ * warning when it has only warnings), or the finding count and one line per finding (stderr).
+ * Returns whether it passed (warnings do not fail it).
  */
 export function printCheck(name, findings, root) {
+    const errors = errorsOf(findings);
     if (findings.length === 0) {
         console.log(`[${name}] passed`);
         return true;
     }
-    console.error(`[${name}] ${findings.length} finding(s)`);
+    if (errors.length === 0) {
+        console.error(`[${name}] passed with ${findings.length} warning(s)`);
+        for (const f of findings)
+            console.error(`  ${formatFinding(f, root)}`);
+        return true;
+    }
+    const warnings = findings.length - errors.length;
+    console.error(`[${name}] ${errors.length} finding(s)${warnings > 0 ? ` and ${warnings} warning(s)` : ""}`);
     for (const f of findings)
         console.error(`  ${formatFinding(f, root)}`);
     return false;

package/dist/check/run.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { checkConfigForms } from "./config-forms.js";
 import { checkDeps } from "./deps.js";
 import { checkMigrations } from "./migrations.js";
+import { checkOrgOverride } from "./org-override.js";
 import { checkPluginPack } from "./plugin-pack.js";
 import { checkPluginPermissions } from "./plugin-permissions.js";
 import { checkPluginState } from "./plugin-state.js";
@@ -29,6 +30,7 @@ export function pluginChecks(scope) {
         { name: "Extension permissions", run: () => checkPluginPermissions(plugins) },
         { name: "Plugin pack", run: () => checkPluginPack(plugins) },
         { name: "Config forms", run: () => checkConfigForms(plugins) },
+        { name: "Org override", run: () => checkOrgOverride(plugins) },
         {
             name: "Tool design",
             run: () => checkToolDesign([...(scope.toolDesignDirs ?? []), ...plugins]),

package/dist/check/source.d.ts

@@ -1,10 +1,17 @@
 import { type Comment } from "oxc-parser";
+/**
+ * One finding of a check. `severity: "warning"` is printed but does not fail the check (only a
+ * few rules warn, e.g. `release-description-zh`); without it the finding is an error.
+ */
 export type Finding = {
     file: string;
     line: number;
     rule: string;
     message: string;
+    severity?: "warning";
 };
+/** The findings that fail a check (every finding that is not a warning). */
+export declare const errorsOf: (findings: Finding[]) => Finding[];
 /** ESTree 节点（oxc-parser 的输出）。只声明本检查用到的公共字段。 */
 export interface Node {
     type: string;

package/dist/check/source.js

@@ -1,6 +1,8 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseSync } from "oxc-parser";
+/** The findings that fail a check (every finding that is not a warning). */
+export const errorsOf = (findings) => findings.filter((f) => f.severity !== "warning");
 const SOURCE_EXT = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
 const TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 /** 只在插件根目录下才有特殊含义的目录名（更深处同名目录是普通源码目录，必须扫描）。 */

package/dist/marketplace/cli.d.ts

@@ -1,20 +1,22 @@
 export declare const MARKETPLACE_USAGE: string;
 /**
  * `capybara-plugin marketplace`: writes (`--write`) or checks (`--check`) the repository's
- * marketplace manifest against reproducible packs of its public plugins ({@link syncMarketplace}).
+ * marketplace manifest, one entry per public plugin at its current version, against reproducible
+ * packs of its public plugins ({@link syncMarketplace}).
  *
  * - `--root <dir>`: the repository (default: the current directory);
  * - `--file <path>`: the manifest, relative to the root (default `.capybara-plugin/marketplace.json`);
  * - `--plugins <glob>`: the plugin directories, relative to the root (default `plugins/*`, or the
  *   root itself when it is a plugin).
  *
- * - `--base <rev>` (with `--check`, on pull requests): the entries the file had at `<rev>` must be
- *   unchanged and first, in order (`marketplace-append-only`), and the entries added since must
- *   match the tree's packs (`marketplace-integrity`).
+ * - `--base <rev>` (with `--check`, on pull requests): an entry's version may only increase over the
+ *   versions `<rev>` lists (`marketplace-version-decrease`), a version `<rev>` lists keeps its
+ *   integrity, and the entries added since must match the tree's packs (`marketplace-integrity`).
  *
- * `--check` exits 1 on any finding (`marketplace-missing`, `marketplace-integrity`,
- * `marketplace-append-only`, `marketplace-invalid`); `--write` appends the missing entries and
- * exits 1 only on `marketplace-invalid`.
+ * `--check` exits 1 on any finding that is not a warning (`marketplace-missing`,
+ * `marketplace-display-stale`, `marketplace-integrity`, `marketplace-version-decrease`,
+ * `marketplace-invalid`); `--write` writes each plugin's entry (replacing its other versions,
+ * refreshing a listed entry's summary and displayName) and exits 1 only on `marketplace-invalid`.
  * Relative paths resolve against `cwd`. Returns the exit code.
  */
 export declare function marketplaceCommand(args: string[], cwd: string): Promise<number>;

package/dist/marketplace/cli.js

@@ -1,25 +1,28 @@
 import { resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { formatFinding } from "../check/report.js";
+import { errorsOf } from "../check/source.js";
 import { MARKETPLACE_FILE, syncMarketplace } from "./marketplace.js";
 export const MARKETPLACE_USAGE = "capybara-plugin marketplace --write|--check [--base <rev>] [--root <dir>] [--file <path>]\n" +
     "                            [--plugins <glob>]";
 /**
  * `capybara-plugin marketplace`: writes (`--write`) or checks (`--check`) the repository's
- * marketplace manifest against reproducible packs of its public plugins ({@link syncMarketplace}).
+ * marketplace manifest, one entry per public plugin at its current version, against reproducible
+ * packs of its public plugins ({@link syncMarketplace}).
  *
  * - `--root <dir>`: the repository (default: the current directory);
  * - `--file <path>`: the manifest, relative to the root (default `.capybara-plugin/marketplace.json`);
  * - `--plugins <glob>`: the plugin directories, relative to the root (default `plugins/*`, or the
  *   root itself when it is a plugin).
  *
- * - `--base <rev>` (with `--check`, on pull requests): the entries the file had at `<rev>` must be
- *   unchanged and first, in order (`marketplace-append-only`), and the entries added since must
- *   match the tree's packs (`marketplace-integrity`).
+ * - `--base <rev>` (with `--check`, on pull requests): an entry's version may only increase over the
+ *   versions `<rev>` lists (`marketplace-version-decrease`), a version `<rev>` lists keeps its
+ *   integrity, and the entries added since must match the tree's packs (`marketplace-integrity`).
  *
- * `--check` exits 1 on any finding (`marketplace-missing`, `marketplace-integrity`,
- * `marketplace-append-only`, `marketplace-invalid`); `--write` appends the missing entries and
- * exits 1 only on `marketplace-invalid`.
+ * `--check` exits 1 on any finding that is not a warning (`marketplace-missing`,
+ * `marketplace-display-stale`, `marketplace-integrity`, `marketplace-version-decrease`,
+ * `marketplace-invalid`); `--write` writes each plugin's entry (replacing its other versions,
+ * refreshing a listed entry's summary and displayName) and exits 1 only on `marketplace-invalid`.
  * Relative paths resolve against `cwd`. Returns the exit code.
  */
 export async function marketplaceCommand(args, cwd) {
@@ -59,14 +62,20 @@ export async function marketplaceCommand(args, cwd) {
         });
         for (const f of r.findings)
             console.error(formatFinding(f, root));
-        if (r.findings.length > 0) {
-            console.error(`\n${r.findings.length} marketplace finding(s)`);
+        const errors = errorsOf(r.findings);
+        if (errors.length > 0) {
+            console.error(`\n${errors.length} marketplace finding(s)`);
             return 1;
         }
         if (values.write) {
             for (const e of r.added)
                 console.log(`added ${e.name}@${e.version}`);
-            console.log(r.added.length === 0 ? "marketplace is up to date" : `wrote ${file}`);
+            for (const k of r.removed)
+                console.log(`removed ${k}`);
+            for (const k of r.refreshed)
+                console.log(`refreshed ${k}`);
+            const changed = r.added.length + r.removed.length + r.refreshed.length > 0;
+            console.log(changed ? `wrote ${file}` : "marketplace is up to date");
         }
         else {
             console.log("marketplace is up to date");

package/dist/marketplace/marketplace.d.ts

@@ -9,44 +9,58 @@ export interface SyncMarketplaceOptions {
     file: string;
     /** Plugin directories relative to `root` (`*` within one segment); default as `discoverPlugins`. */
     plugins?: string;
-    /** Append the missing entries to `file` (`--write`); otherwise only report them (`--check`). */
+    /** Write the plugins' entries into `file` (`--write`); otherwise only report them (`--check`). */
     write: boolean;
     /**
      * A git revision (`--check --base <rev>`, pull requests): the entries the file had there are
-     * published and must still be there, unchanged and in the same order (only appending is
-     * allowed; `marketplace-append-only`), and every entry added since must match the tree's pack
-     * (`marketplace-integrity`). A file the base does not have constrains nothing.
+     * published. An entry of a version the base lists must keep its source and integrity
+     * (`marketplace-integrity`); an entry of a version the base does not list must be newer than
+     * every version the base lists for that plugin (`marketplace-version-decrease`) and, when it is
+     * the tree's version, match the tree's pack (`marketplace-integrity`). A file the base does not
+     * have constrains nothing.
      */
     base?: string;
 }
 /** The result of {@link syncMarketplace}. */
 export interface SyncMarketplaceResult {
-    /** Entries for `(name, version)` pairs the file does not list yet (appended with `write`). */
+    /** New entries: plugins not listed at their current version (written with `write`). */
     added: MarketplaceEntry[];
+    /** `name@version` of the other entries of the tree's plugins (dropped with `write`). */
+    removed: string[];
     /**
-     * `marketplace-invalid` (the file does not parse, or would not after appending),
-     * `marketplace-integrity` (with a base: an entry added since names another package or integrity
-     * than the tree's pack), `marketplace-append-only` (with a base: a published entry changed, moved
-     * or went away) and, without `write`, `marketplace-missing` (one per added entry).
+     * `name@version` of listed entries whose `summary` / `displayName` differ from plugin.json
+     * (rewritten with `write`; source and integrity never change).
+     */
+    refreshed: string[];
+    /**
+     * `marketplace-invalid` (the file does not parse, or would not after writing),
+     * `marketplace-integrity` and `marketplace-version-decrease` (with a base, see
+     * {@link SyncMarketplaceOptions.base}) and, without `write`, `marketplace-missing` (one per
+     * plugin whose current version is not listed, or not as its only entry) and
+     * `marketplace-display-stale` (a listed entry's summary / displayName differ from plugin.json).
      */
     findings: Finding[];
 }
 /**
- * `capybara-plugin marketplace`: keeps a plugin repository's `marketplace.json` listing every
- * published version of its public plugins (package ecosystem spec §5.2; one entry per
- * `(name, version)`, Decision 7 of phase A3b). Each public plugin (not `"private": true`) is packed
- * reproducibly with {@link packPlugin}; when the file has no entry for its name and version, an
- * entry `{ name, version, summary, homepage?, permissions, source: { npm: { package, version,
- * integrity } } }` is added (`integrity` the pack's sha512, which the release then publishes
- * byte for byte; `permissions` display only). A version already listed is not packed or compared:
- * once published, its bytes are the release gate's business (`release --marketplace`), so a later
- * source or toolchain change at the same version is not a finding. With `base`, published entries
- * must be unchanged and first in order, and entries added since must match the tree's packs.
- * Entries of versions no longer in the tree are kept, so a pinned commit lists what it pins and
- * older versions stay importable. The file is written formatted as Biome formats it
- * ({@link formatMarketplaceJson}).
- * With `write`, the new entries are appended in plugin order (nothing is written when there is any
- * other finding).
+ * `capybara-plugin marketplace`: keeps a plugin repository's `marketplace.json` listing one entry
+ * per public plugin, its current version (plugin component management spec §13.2, replacing the
+ * one-entry-per-version rule of the package ecosystem spec §5.2). Each public plugin (not
+ * `"private": true`) not listed at its version is packed reproducibly with {@link packPlugin} and
+ * gets an entry `{ name, version, summary, displayName?, homepage?, permissions, source: { npm: {
+ * package, version, integrity } } }` (`summary` from the plugin.json `description`, a string being
+ * `en`; `displayName` copied from plugin.json; `integrity` the pack's sha512, which the release
+ * then publishes byte for byte; `permissions` display only). The new entry takes the place of the
+ * plugin's first entry (a version that moved), the plugin's other entries are dropped (also those
+ * of a file written in the older one-entry-per-version form), and a plugin not listed yet is
+ * appended. Entries of plugins not in the tree are kept. A version already listed is not packed or
+ * compared: once published, its bytes are the release gate's business (`release --marketplace`),
+ * so a later source or toolchain change at the same version is not a finding; only its display
+ * fields (`summary`, `displayName`) are refreshed from the source plugin.json. Every other field
+ * of a kept entry stays as written, among them `deprecated`, which the maintainer sets by hand on
+ * a published version's entry (not in plugin.json: that would change the packed bytes); a new
+ * version's entry has none, and no rule compares it with the base. With `base`, see
+ * {@link SyncMarketplaceOptions.base}. The file is written formatted as Biome formats it
+ * ({@link formatMarketplaceJson}); nothing is written when there is any other finding.
  */
 export declare function syncMarketplace(opts: SyncMarketplaceOptions): Promise<SyncMarketplaceResult>;
 /**

package/dist/marketplace/marketplace.js

@@ -4,16 +4,22 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, relative } from "node:path";
 import { isSensitivePermissionKey, PACKAGES_MAX_BYTES_DEFAULT, permissionKeys, permissionSetOfPackage, readExtensionPackage, WARNINGS_KEY_PREFIX, } from "@capybara-hq/kernel";
-import { MARKETPLACE_LIMITS, PLUGIN_MANIFEST_FILE, parseMarketplaceManifest, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
+import { MARKETPLACE_LIMITS, PLUGIN_MANIFEST_FILE, parseMarketplaceManifest, parsePluginManifest, pluginDescription, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
 import { discoverPlugins } from "../discover.js";
 import { integrityOf } from "../integrity.js";
 import { packPlugin } from "../pack/pack.js";
+import { compareSemver, parseSemver } from "../release/semver.js";
 export { MARKETPLACE_FILE } from "./file.js";
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-/** The marketplace summary of a plugin: its plugin.json description, cut to the summary limit. */
-function summaryOf(description) {
+/** The marketplace summary text: a description cut to the summary limit. */
+function cut(text) {
     const max = MARKETPLACE_LIMITS.summaryChars;
-    return description.length <= max ? description : `${description.slice(0, max - 1)}…`;
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+/** The marketplace summary of a plugin: its plugin.json description (`{ en, zh? }`), each cut. */
+function summaryOf(description) {
+    const d = pluginDescription(description);
+    return { en: cut(d.en), ...(d.zh !== undefined && { zh: cut(d.zh) }) };
 }
 /** The permission summary of a packed plugin, as the kernel computes it at import (display only). */
 async function permissionsOf(bytes, hasExtension) {
@@ -30,29 +36,70 @@ async function permissionsOf(bytes, hasExtension) {
 }
 /** An entry's version: `version`, else its npm source's. */
 const versionOf = (e) => e.version ?? ("npm" in e.source ? e.source.npm.version : undefined);
+/** The display fields of a plugin's source plugin.json; undefined when it does not parse. */
+function displayOf(json) {
+    const m = parsePluginManifest(json);
+    if ("errors" in m)
+        return undefined;
+    return {
+        summary: summaryOf(m.description),
+        ...(m.displayName !== undefined && { displayName: m.displayName }),
+    };
+}
 /**
- * `capybara-plugin marketplace`: keeps a plugin repository's `marketplace.json` listing every
- * published version of its public plugins (package ecosystem spec §5.2; one entry per
- * `(name, version)`, Decision 7 of phase A3b). Each public plugin (not `"private": true`) is packed
- * reproducibly with {@link packPlugin}; when the file has no entry for its name and version, an
- * entry `{ name, version, summary, homepage?, permissions, source: { npm: { package, version,
- * integrity } } }` is added (`integrity` the pack's sha512, which the release then publishes
- * byte for byte; `permissions` display only). A version already listed is not packed or compared:
- * once published, its bytes are the release gate's business (`release --marketplace`), so a later
- * source or toolchain change at the same version is not a finding. With `base`, published entries
- * must be unchanged and first in order, and entries added since must match the tree's packs.
- * Entries of versions no longer in the tree are kept, so a pinned commit lists what it pins and
- * older versions stay importable. The file is written formatted as Biome formats it
- * ({@link formatMarketplaceJson}).
- * With `write`, the new entries are appended in plugin order (nothing is written when there is any
- * other finding).
+ * `raw` with its `summary` and `displayName` set to `d` (in place, `displayName` right after
+ * `summary` when it is new, removed when plugin.json has none); undefined when they already equal.
+ */
+function refreshDisplay(raw, d) {
+    if (!isObj(raw))
+        return undefined;
+    if (canonical(raw.summary) === canonical(d.summary) &&
+        canonical(raw.displayName) === canonical(d.displayName)) {
+        return undefined;
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (k === "displayName")
+            continue;
+        out[k] = k === "summary" ? d.summary : v;
+        if (k === "summary" && d.displayName !== undefined)
+            out.displayName = d.displayName;
+    }
+    if (!("summary" in raw)) {
+        out.summary = d.summary;
+        if (d.displayName !== undefined)
+            out.displayName = d.displayName;
+    }
+    return out;
+}
+/**
+ * `capybara-plugin marketplace`: keeps a plugin repository's `marketplace.json` listing one entry
+ * per public plugin, its current version (plugin component management spec §13.2, replacing the
+ * one-entry-per-version rule of the package ecosystem spec §5.2). Each public plugin (not
+ * `"private": true`) not listed at its version is packed reproducibly with {@link packPlugin} and
+ * gets an entry `{ name, version, summary, displayName?, homepage?, permissions, source: { npm: {
+ * package, version, integrity } } }` (`summary` from the plugin.json `description`, a string being
+ * `en`; `displayName` copied from plugin.json; `integrity` the pack's sha512, which the release
+ * then publishes byte for byte; `permissions` display only). The new entry takes the place of the
+ * plugin's first entry (a version that moved), the plugin's other entries are dropped (also those
+ * of a file written in the older one-entry-per-version form), and a plugin not listed yet is
+ * appended. Entries of plugins not in the tree are kept. A version already listed is not packed or
+ * compared: once published, its bytes are the release gate's business (`release --marketplace`),
+ * so a later source or toolchain change at the same version is not a finding; only its display
+ * fields (`summary`, `displayName`) are refreshed from the source plugin.json. Every other field
+ * of a kept entry stays as written, among them `deprecated`, which the maintainer sets by hand on
+ * a published version's entry (not in plugin.json: that would change the packed bytes); a new
+ * version's entry has none, and no rule compares it with the base. With `base`, see
+ * {@link SyncMarketplaceOptions.base}. The file is written formatted as Biome formats it
+ * ({@link formatMarketplaceJson}); nothing is written when there is any other finding.
  */
 export async function syncMarketplace(opts) {
     const findings = [];
     const at = (rule, message) => findings.push({ file: opts.file, line: 1, rule, message });
+    const none = () => ({ added: [], removed: [], refreshed: [], findings });
     if (!existsSync(opts.file)) {
         at("marketplace-invalid", `${opts.file} does not exist: create it with schemaVersion, name, owner and "plugins": []`);
-        return { added: [], findings };
+        return none();
     }
     let raw;
     try {
@@ -60,22 +107,23 @@ export async function syncMarketplace(opts) {
     }
     catch (e) {
         at("marketplace-invalid", `not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
-        return { added: [], findings };
+        return none();
     }
     const parsed = parseMarketplaceManifest(raw);
     if ("errors" in parsed) {
         at("marketplace-invalid", parsed.errors.join("; "));
-        return { added: [], findings };
+        return none();
     }
+    // The parser keeps the order, so parsed.plugins[i] is rawEntries[i].
     const rawEntries = isObj(raw) && Array.isArray(raw.plugins) ? raw.plugins : [];
-    /** `name@version` of the entries added since `opts.base` (all of them without a base). */
-    let addedSinceBase;
+    /** `name@version` of the entries the base lists (undefined without a base). */
+    let baseKeys;
     if (opts.base !== undefined) {
         const baseEntries = entriesAt(opts.root, opts.file, opts.base);
-        findings.push(...appendOnly(baseEntries, rawEntries, opts.file));
-        addedSinceBase = new Set(rawEntries.slice(baseEntries.length).map((e) => keyOfRaw(e)));
+        findings.push(...publishedRules(baseEntries, rawEntries, opts.file));
+        baseKeys = new Set(baseEntries.map(keyOfRaw));
     }
-    const added = [];
+    const updates = [];
     const out = await mkdtemp(join(tmpdir(), "capybara-marketplace-"));
     try {
         for (const dir of discoverPlugins(opts.root, opts.plugins)) {
@@ -87,15 +135,33 @@ export async function syncMarketplace(opts) {
             if (pkg.private === true)
                 continue;
             const source = JSON.parse(await readFile(manifestFile, "utf8"));
+            // (the display fields of a listed entry are refreshed from this source plugin.json)
             const name = String(source.name);
             const version = String(pkg.version);
-            const listed = parsed.plugins.filter((e) => e.name === name && versionOf(e) === version);
+            const mine = parsed.plugins.flatMap((e, i) => (e.name === name ? [{ e, i }] : []));
+            const listed = mine.filter(({ e }) => versionOf(e) === version);
+            const dropped = mine
+                .filter(({ e }) => versionOf(e) !== version)
+                .map(({ e }) => `${name}@${versionOf(e) ?? "(no version)"}`);
             // A version already listed is published (or about to be): its bytes are the release gate's
             // business, so a later source or toolchain change at the same version is not a finding here.
             // Only an entry added since the base is compared with the tree's pack.
-            const toCompare = listed.filter((e) => addedSinceBase?.has(`${e.name}@${versionOf(e)}`));
-            if (listed.length > 0 && toCompare.length === 0)
+            const toCompare = listed.filter(({ e }) => baseKeys !== undefined && !baseKeys.has(keyOf(e)));
+            const kept = listed[0];
+            /** Keeps the listed entry: drops the other versions, refreshes its display fields. */
+            const keep = (raw) => {
+                const display = displayOf(source);
+                const fresh = display === undefined ? undefined : refreshDisplay(raw, display);
+                if (dropped.length > 0 || fresh !== undefined) {
+                    const entry = fresh ?? raw;
+                    updates.push({ name, version, entry, isNew: false, dropped, refreshed: !!fresh });
+                }
+            };
+            if (kept !== undefined && toCompare.length === 0) {
+                keep(rawEntries[kept.i]);
                 continue;
+            }
+            // Packed: the plugin is not listed at its version, or its entry is new since the base.
             const r = await packPlugin(dir, out);
             const bytes = new Uint8Array(await readFile(r.file));
             const npm = {
@@ -103,7 +169,7 @@ export async function syncMarketplace(opts) {
                 version: r.manifest.version,
                 integrity: integrityOf(bytes),
             };
-            for (const e of toCompare) {
+            for (const { e } of toCompare) {
                 const src = "npm" in e.source ? e.source.npm : undefined;
                 if (src?.package !== npm.package || src.integrity !== npm.integrity) {
                     const was = src === undefined
@@ -113,39 +179,76 @@ export async function syncMarketplace(opts) {
                         `with integrity ${npm.integrity}: run capybara-plugin marketplace --write`);
                 }
             }
-            if (listed.length > 0)
+            if (kept !== undefined) {
+                keep(rawEntries[kept.i]);
                 continue;
-            added.push({
+            }
+            const entry = {
                 name: r.manifest.name,
                 version: npm.version,
-                summary: { en: summaryOf(r.manifest.description) },
+                summary: summaryOf(r.manifest.description),
+                ...(r.manifest.displayName !== undefined && { displayName: r.manifest.displayName }),
                 ...(r.manifest.homepage !== undefined && { homepage: r.manifest.homepage }),
                 permissions: await permissionsOf(bytes, r.manifest.extension !== undefined),
                 source: { npm },
-            });
+            };
+            updates.push({ name, version, entry, isNew: true, dropped, refreshed: false });
         }
     }
     finally {
         await rm(out, { recursive: true, force: true });
     }
+    const added = updates.filter((u) => u.isNew).map((u) => u.entry);
+    const removed = updates.flatMap((u) => u.dropped);
+    const refreshed = updates.filter((u) => u.refreshed).map((u) => `${u.name}@${u.version}`);
     if (!opts.write) {
-        for (const e of added) {
-            at("marketplace-missing", `${e.name}@${e.version} is not listed: run capybara-plugin marketplace --write`);
+        for (const u of updates) {
+            if (u.refreshed) {
+                at("marketplace-display-stale", `${u.name}@${u.version} has a summary or displayName other than its plugin.json's: ` +
+                    "run capybara-plugin marketplace --write");
+            }
+            if (!u.isNew && u.dropped.length === 0)
+                continue;
+            const also = u.dropped.map((d) => d.slice(u.name.length + 1)).join(", ");
+            at("marketplace-missing", u.isNew
+                ? `${u.name}@${u.version} is not listed${also === "" ? "" : ` (the marketplace lists ${also})`}: ` +
+                    "one entry per plugin, its current version; run capybara-plugin marketplace --write"
+                : `${u.name}@${u.version} is not the plugin's only entry (also ${also}): ` +
+                    "one entry per plugin, its current version; run capybara-plugin marketplace --write");
+        }
+        return { added, removed, refreshed, findings };
+    }
+    if (findings.length > 0 || updates.length === 0)
+        return { added, removed, refreshed, findings };
+    const byName = new Map(updates.map((u) => [u.name, u]));
+    const placed = new Set();
+    const plugins = [];
+    for (const e of rawEntries) {
+        const name = isObj(e) ? String(e.name) : "";
+        const u = byName.get(name);
+        if (u === undefined) {
+            plugins.push(e);
+        }
+        else if (!placed.has(name)) {
+            placed.add(name);
+            plugins.push(u.entry);
         }
-        return { added, findings };
     }
-    if (findings.length > 0 || added.length === 0)
-        return { added, findings };
+    for (const u of updates)
+        if (!placed.has(u.name))
+            plugins.push(u.entry);
     const next = isObj(raw) ? { ...raw } : {};
-    next.plugins = [...(Array.isArray(next.plugins) ? next.plugins : []), ...added];
+    next.plugins = plugins;
     const check = parseMarketplaceManifest(next);
     if ("errors" in check) {
         at("marketplace-invalid", `the new entries do not parse: ${check.errors.join("; ")}`);
-        return { added, findings };
+        return { added, removed, refreshed, findings };
     }
     await writeFile(opts.file, formatMarketplaceJson(next));
-    return { added, findings };
+    return { added, removed, refreshed, findings };
 }
+/** `name@version` of a parsed entry (`?` without a version). */
+const keyOf = (e) => `${e.name}@${versionOf(e) ?? "?"}`;
 /** `name@version` of a raw entry (`?` for what is missing). */
 function keyOfRaw(e) {
     if (!isObj(e))
@@ -153,7 +256,7 @@ function keyOfRaw(e) {
     const npm = isObj(e.source) && isObj(e.source.npm) ? e.source.npm : {};
     return `${String(e.name ?? "?")}@${String(e.version ?? npm.version ?? "?")}`;
 }
-/** JSON with object keys sorted (deep equality of entries regardless of key order). */
+/** JSON with object keys sorted (deep equality regardless of key order). */
 function canonical(v) {
     if (Array.isArray(v))
         return `[${v.map(canonical).join(",")}]`;
@@ -184,25 +287,68 @@ function entriesAt(root, file, base) {
     const raw = JSON.parse(text);
     return isObj(raw) && Array.isArray(raw.plugins) ? raw.plugins : [];
 }
+/** A raw entry's version when it is a plain semver (else undefined: not ordered). */
+function semverOfRaw(e) {
+    const v = keyOfRaw(e).split("@").pop();
+    return v !== undefined && parseSemver(v) !== undefined ? v : undefined;
+}
 /**
- * `marketplace-append-only`: the base's entries are published, so the current list must start with
- * exactly them, in the same order (an entry is never edited, removed or moved; new ones go last).
+ * The rules on the entries published at the base: `marketplace-integrity`, a version the base
+ * lists keeps its source (package and integrity); `marketplace-version-decrease`, a version the
+ * base does not list must be newer than every version the base lists for that plugin, and a
+ * plugin's newest listed version may not be older than the newest the base lists. Display
+ * fields (summary, displayName, permissions, homepage) may change, entries may move, and a
+ * plugin's older versions may go (one entry per plugin).
  */
-function appendOnly(base, current, file) {
+function publishedRules(base, current, file) {
     const out = [];
-    base.forEach((b, i) => {
-        const c = current[i];
-        if (c !== undefined && canonical(c) === canonical(b))
-            return;
-        const key = keyOfRaw(b);
-        const moved = current.some((x) => canonical(x) === canonical(b));
-        out.push({
-            file,
-            line: 1,
-            rule: "marketplace-append-only",
-            message: `${key} is published at the base and ${moved ? "moved" : c !== undefined && keyOfRaw(c) === key ? "was edited" : "went away"}: published entries never change and new ones are appended at the end`,
-        });
-    });
+    const finding = (rule, message) => out.push({ file, line: 1, rule, message });
+    const baseByKey = new Map(base.map((b) => [keyOfRaw(b), b]));
+    const newest = new Map();
+    for (const b of base) {
+        const v = semverOfRaw(b);
+        const name = isObj(b) ? String(b.name) : "?";
+        const top = newest.get(name);
+        if (v !== undefined && (top === undefined || compareSemver(v, top) > 0))
+            newest.set(name, v);
+    }
+    /** `name@version` of the entries reported as `marketplace-version-decrease`. */
+    const decreased = new Set();
+    for (const c of current) {
+        const key = keyOfRaw(c);
+        const b = baseByKey.get(key);
+        const src = (e) => (isObj(e) ? e.source : undefined);
+        if (b !== undefined) {
+            if (canonical(src(c)) !== canonical(src(b))) {
+                finding("marketplace-integrity", `${key} is published at the base with the source ${canonical(src(b))}, now ` +
+                    `${canonical(src(c))}: a published version keeps its integrity (bump the version instead)`);
+            }
+            continue;
+        }
+        const v = semverOfRaw(c);
+        const top = newest.get(isObj(c) ? String(c.name) : "?");
+        if (v !== undefined && top !== undefined && compareSemver(v, top) < 0)
+            decreased.add(key);
+    }
+    // A plugin's newest listed version may not fall below the newest the base lists, also when it
+    // moves back to an older version the base lists too (a base in the older form).
+    const newestNow = new Map();
+    for (const c of current) {
+        const v = semverOfRaw(c);
+        const name = isObj(c) ? String(c.name) : "?";
+        const top = newestNow.get(name);
+        if (v !== undefined && (top === undefined || compareSemver(v, top) > 0))
+            newestNow.set(name, v);
+    }
+    for (const [name, v] of newestNow) {
+        const top = newest.get(name);
+        if (top !== undefined && compareSemver(v, top) < 0)
+            decreased.add(`${name}@${v}`);
+    }
+    for (const key of decreased) {
+        const name = key.slice(0, key.lastIndexOf("@"));
+        finding("marketplace-version-decrease", `${key} is older than ${newest.get(name)}, which the base lists: an entry's version may only increase`);
+    }
     return out;
 }
 const INDENT = "  ";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/plugin-tools",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.5",
   "description": "Capybara plugin toolchain: the capybara-plugin CLI to pack, check and release Capybara plugins",
   "license": "Apache-2.0",
   "repository": {
@@ -51,12 +51,12 @@
     "esbuild": "0.28.2",
     "oxc-parser": "^0.154.0",
     "tar-stream": "3.2.2",
-    "@capybara-hq/kernel": "^0.1.0-rc.4",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.2"
+    "@capybara-hq/kernel": "^0.1.0-rc.5",
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.3"
   },
   "devDependencies": {
     "zod": "^4.6.7",
-    "@capybara-hq/testing": "0.1.0-rc.4"
+    "@capybara-hq/testing": "0.1.0-rc.6"
   },
   "scripts": {
     "build": "tsc -b"